allow certificate chains with a length three (one sub-CA)